Actor claims leak of 24 million Iraqi electoral records
A threat actor posted on an underground forum a ZIP archive of about 753 MB in CSV format that, according to them, contains 24 million records from Iraq's Independent High Electoral Commission (IHEC). The file name references 2019, which suggests recirculation of older electoral data; per DailyDarkWeb, IHEC has not confirmed any incident and the claim is unverified. Monitor for confirmation and treat the dataset as a risk of identity fraud and phishing against Iraqi citizens.
What happened
A threat actor posted on an underground forum an archive they claim contains 24 million records from Iraq's Independent High Electoral Commission (IHEC), the national body that runs the country's elections. It is a ZIP file of about 753 MB in CSV format. The file name references 2019 and IHEC has not confirmed any incident, per DailyDarkWeb.
Why it matters
If real, a voter-scale dataset can enable identity fraud and targeted phishing against Iraqi citizens. The 2019 label suggests older data being recirculated, which lowers the likelihood of a fresh intrusion while keeping the misuse risk. There is no official confirmation of a breach so far.
What to do
Track threat intelligence channels for confirmation, samples, or a response from IHEC. Organizations with operations, customers, or staff in Iraq should strengthen anti-phishing defenses and monitor for misuse of voters' personal data.
For the technical team
- Affected
- Independent High Electoral Commission (IHEC), órgão que administra as eleições do Iraque; arquivo alegado de 24 milhões · Iraq's Independent High Electoral Commission (IHEC), the national body that runs the country's elections; alleged dataset of 24 million records.
- Exploitation
- Unverified claim posted on an underground forum; reported by DailyDarkWeb on X, first logged on October 28, 2026. IHEC has not confirmed an incident, per the source. No mention of KEV, PoC, or active exploitation.
- Fix
- Not applicable; the sources indicate no fix or mitigation.
- Vector
- Alleged data leak. No intrusion vector described in the sources; the publication is a ZIP archive of about 753 MB in CSV format on an underground forum.
- More details
- DailyDarkWeb assesses that the 2019 label suggests older electoral data being recirculated rather than a fresh intrusion. The source classifies the post as an unverified threat-actor claim and states it is not confirmation of a breach. No attack chain, responsible group, or discoverer details.
Timeline
First entry: leak claim posted on an underground forum, with doubt about the data's age.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
